01. Who is responsible
KACHAi, an AI food photography app, and its website at kachai.app are operated by SEONG GOAT ENTERTAINMENT COMPANY LIMITED, a company registered in Macao. This Privacy Policy review draft is prepared in English.
02. Information processed
Image generation processes your selected food image, scene prompt and generation settings. Generated images are stored with gallery information such as the image location, creation time and selected scene/category. Account identifiers connect authentication, gallery records, subscription status and credit balances.
The reviewed app source creates an anonymous Firebase session at its entry page and sends the Firebase user ID to RevenueCat when linking purchases. Firebase’s current provider configuration also enables email/password, Google and Apple sign-in. Where supplied by a sign-in provider, the reviewed user-record creation code can save email address, display name and profile image.
03. How information is used
Images, prompts and generation settings are processed to produce the requested food photographs. Gallery records support viewing and managing generated images. Account and purchase information supports authentication, subscription verification and credit accounting. The deployed generation function records the account identifier, model, aspect ratio and usage information in backend logs. Firebase Performance Monitoring is enabled in the reviewed project configuration to help understand app and network performance.
04. AI processing and third parties
The deployed main generation function uses Google’s Gemini Developer API through the Google GenAI SDK. It calls the Interactions API with gemini-3.1-flash-image, sending the selected image and prompt with image-generation settings. The generated image is then saved through Firebase / Google Cloud.
Firebase / Google Cloud provides authentication, database, storage and backend services. RevenueCat receives the app user ID and purchase/subscription information to manage subscription access and purchase analytics. Apple processes iOS In-App Purchases. The observed active RevenueCat integration forwards purchase events to KACHAi’s Google Cloud backend.
05. Storage, transfers and security
The current gallery database uses Cloud Firestore’s nam5 US multi-region. The current Firebase image storage bucket is in us-central1 (Iowa, United States). The reviewed main generation function also runs in us-central1. These locations do not establish the processing location of all authentication, AI, subscription or diagnostic data.
06. Retention
The image storage bucket currently has a seven-day soft-delete recovery period and object versioning is disabled. No bucket lifecycle rule is configured for automatic age-based deletion. This does not define a complete service retention policy or establish that all other data is kept indefinitely.
The deployed Interactions API request does not explicitly disable server-side request storage. The matched food easy ai AI project currently has GenerateContent and Interactions request storage enabled, with a 55-day rolling retention setting. The settings state that older logs are automatically deleted according to that window, or earlier if the storage limit is reached. This setting is not a universal deadline for all Google safety records, datasets, backups or KACHAi account/gallery data.
07. Deleting images, accounts and data
The reviewed app source includes gallery delete controls. Single-image deletion requests deletion of the Firebase image object and then its gallery record. The batch-delete action also attempts both operations for selected Firebase images and handles individual errors. This source inspection has not been treated as a completed deletion test.
The image bucket’s soft-delete policy can retain recoverable object copies for seven days after an object is deleted. Deleting an image is different from deleting the entire account or cancelling an Apple subscription.
08. Analytics, diagnostics, advertising and tracking
The current FlutterFlow configuration enables Firebase Performance Monitoring. Google’s documentation describes processing of Firebase installation IDs and IP-associated performance events for this service. The same project’s Google Analytics, Crashlytics and AdMob switches are off.
RevenueCat still handles purchase history and purchase analytics as part of subscription management. Disabling Google Analytics does not mean that no purchase analytics or operational diagnostics are processed.
09. Website resources
The website is hosted through Cloudflare Workers static assets on the existing kachai-website service and kachai.app domain. The current website uses locally hosted stylesheets, logo assets and food images, together with system fonts. The website does not load the previous external Unsplash image or Google Fonts. Hosting and security request processing still require the verification described below.